Windows Analysis Report https://spark.adobe.com/page/FynP6ihgtLS9G/;

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: https://spark.adobe.com/page/FynP6ihgtLS9G/;

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Source: https://arcomet.ae/property/	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering
Source: https://spark.adobe.com/page/FynP6ihgtLS9G/;?page-mode=static	SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish29

Source: Yara match	File source: 03534.0.pages.csv, type: HTML
Source: Yara match	File source: 75199.1.pages.csv, type: HTML
Source: Yara match	File source: 92257.3.pages.csv, type: HTML

Phishing site detected (based on shot template match)

Source: https://arcomet.ae/property/

Matcher: Template: office matched

Yara detected HtmlPhish7

Source: Yara match	File source: 35678.2.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, type: DROPPED

Yara detected HtmlPhish10

Source: Yara match	File source: 35678.2.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3, type: DROPPED

Phishing site detected (based on image similarity)

Source: https://arcomet.ae/property/

Matcher: Found strong image similarity, brand: Microsoft image: 35678.2.img.3.gfk.csv C3FC46C5799C76F9107504028F39190F

HTML body contains low number of good links

Source: https://arcomet.ae/property/	HTTP Parser: Number of links: 0
Source: https://arcomet.ae/property/	HTTP Parser: Number of links: 0

No HTML title found

Source: https://spark.adobe.com/page/FynP6ihgtLS9G/;	HTTP Parser: HTML title missing
Source: https://spark.adobe.com/page/FynP6ihgtLS9G/;	HTTP Parser: HTML title missing
Source: https://arcomet.ae/property/	HTTP Parser: HTML title missing
Source: https://arcomet.ae/property/	HTTP Parser: HTML title missing

META author tag missing

Source: https://spark.adobe.com/page/FynP6ihgtLS9G/;	HTTP Parser: No <meta name="author".. found
Source: https://spark.adobe.com/page/FynP6ihgtLS9G/;	HTTP Parser: No <meta name="author".. found
Source: https://arcomet.ae/property/	HTTP Parser: No <meta name="author".. found
Source: https://arcomet.ae/property/	HTTP Parser: No <meta name="author".. found

META copyright tag missing

Source: https://spark.adobe.com/page/FynP6ihgtLS9G/;	HTTP Parser: No <meta name="copyright".. found
Source: https://spark.adobe.com/page/FynP6ihgtLS9G/;	HTTP Parser: No <meta name="copyright".. found
Source: https://arcomet.ae/property/	HTTP Parser: No <meta name="copyright".. found
Source: https://arcomet.ae/property/	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.4:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.4:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.203.70.208:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.193.29:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.88.152:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.88.152:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.88.152:443 -> 192.168.2.4:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.82.209.183:443 -> 192.168.2.4:49933 version: TLS 1.2

Networking:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.70.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.70.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.70.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.70.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.70.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.70.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.70.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.70.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.203.70.208
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 51.11.168.232
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.102.62

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=314559&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20211104T062858Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=899771663f1e4f0489c4c49a69ef8f77&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1239136&metered=false&nettype=ethernet&npid=sc-314559&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&smBiosDm=VMware7%2C1&tl=2&tsu=1239136&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32068&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAQzI870oD8kCXVu/npv42UPDGWruVmuLL3LqEJTusQHcBU2/NF6YDEeE5DgLG51JH9SC+NfLB87l0MohPYLooPQ+CMNE2J9CAKKUmaTzGyJ030daaWveiDPllEVnTPxAhcou1g8KUTDH/nYJbF9dAmL2ehEEda/i4UTmKInFEMcDst44oUaYQyT2MF5t87RXh7sLILnX3RfPo85/KH//62OhGtg/Q7b1cEcosRF9Xam5hZVo/Y+QaY9ZSqj+0cfUCzAhPqTPfcD1uWOj9hTMajvDz6PLVK4cnlG6gBDg4R7HMSgaTIOV4+TUMIaEbSLCGG8M66m7AxZkiP24BABIgUMDZgAACNgGuhs8RZPIqAGmTvfLEgK/CegE2uyoEIcL3Zk9IM3AG5vu/EgJDxFhi56ntiCCkIXB+Ckmbl/9GrcbOyfX8jqTo0boOMcJ6/wq3iZ8e5qfUVuX+h16PQchs2Z+r8XfPE9FBkHVNy5ODGFhEfFmkYjCGJPWwnHG6XUs3VDkQAvKlZoZoYHh/gO49rhz3RLHJ9HydRLmErPScTpoMPhLEMhSJh0AgXUW2q0zP+nhw9KYAhTtbO/+CAwt811d5vFvEmizYNG8mehhOtXxodZzwuOgkTakkuIrhTmwFXFuAtp/iSdHYuZLFfhXL+S7fHXt/X659IYA7b+2HEPNzFh2dQXgwhxLCDlQb0Asp7EUQNnmz+oDnr+bBsP+HEhUK44VuwiCn0GKsaKMruutj+2+vN9xU9NDnoGIgVw7pJ8cL5SL1Ipx94zCrK1CSjoVPetltYjTNk1utTPo/2SglQN+21kebCU3hGwmF0O8Cuh0mSXMQnfQLSAmgbHJbCjWB5FJNtaiSuIJxPuCIGNe9wmvQ5ad+ldl2fowUhueQzE7L0z5AHzy/IwgoQgWRe4e+oL3rE+c1QE=&p=Cache-Control: no-cacheMS-CV: EDyLumUfEkKEnDL0.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20211104T062858Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ab14402fe92a4b93b001cd143baaa856&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1239136&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=VMware%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=VMware7%2C1&tl=2&tsu=1239136&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32068&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAVQDLVkDT1mTuizCnMbBwJX1p51hg8O4y7DFKime7VQa0tFV8QpJMZfLxt2Q/E/NfH3xi4lC8MaDIPtR6T2aOrYG+56cXGU1fTYUiFaP0/gxhVEse0l598ZFkWSGZWifoOo0esOzlpKxFpXpxqrSOSWLbLOFVlDB3DNINSFX0DoDexqPWZfLJCDpnEo0naH2jcqP5XFb/rezKPt2hJOT5+5mhcHQiVSdR/nOG9t8dfMDKWe1KHWR77eYrTW5/kBz4m+47Jm2T4zxy6SdLEbEGgJFoG8ZeYMm2GkWehzgpsmQ794FaG7tcK80ey5AnavrpfJqakFVzmNOWQKRSxncf0cDZgAACBqCLq/kV1VnqAGsKDTLSr8cCeSo/AXyjXNOOk7htbfjDoWTkEONLqPvYgimex6AsRsNqda/b7C5oa4/kcmjaM1GpKEHj3P6daY9Mw8I+nR/Okz/xq768t8jIJZnMPvmAdcgBn3lA51y10O5NIsTHyzBGr4GAnu3ALDQzU1LDTAcBxUlbT89VZ0yenUWLJ5JjPej/dJww+c2QBT+rvX0js9tIT0YKIkR1EyAxJXkl8wN2x5taGKIFbxbYQ0zB/S1qW66xiua1fAu8Ih5yGzUPg8P7dUE3qmVbjxRMKMHEpSy8xGOiY25GuBsrrHvjMncIk0UDf2azHvW6f+SMsPrfTl5keOUqVIx41NWNVkI/mymD4rd8HjSGcbxva5/za0a+mS46OeGTHuVgJYGUXNFaaLzmndvLtFnrfCNttk1bhLpdZyZIMkQv0MADalv7P7bH09QOArbTFceVP/ac1ENv/VH+FTU/lwtW4ggL0Q7ahD7vuKCnrr1VtCJXGqkAb5rFXREm55UxN/dE9UJwbqGEH3X3mNFoHcezutx8WXVxuSnF6DkZ5Ddma9m36rCpBI7YwLF1QE=&p=Cache-Control: no-cacheMS-CV: EDyLumUfEkKEnDL0.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fwlink/?linkid=851290&os=Windows&osVer=10.0.17134.1.amd64fre.rs4_release.180410-1804&sku=Professional&locale=en-US&ring=Retail&deviceId=%7BA2AB526A-D38D-4FC9-8BA0-E34B8D6354E8%7D&appVer=0.3.0.0&ubr=1&campaignId=%7B3f5c1adb-a179-4718-8e9f-0b616dd7abe7%7D HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: cpprestsdk/2.8.0Host: go.microsoft.com
Source: global traffic	HTTP traffic detected: GET /settings/v2.0/wsd/unpv3?linkid=851290&os=Windows&osVer=10.0.17134.1.amd64fre.rs4_release.180410-1804&sku=Professional&locale=en-US&ring=Retail&deviceId=%7BA2AB526A-D38D-4FC9-8BA0-E34B8D6354E8%7D&appVer=0.3.0.0&ubr=1&campaignId=%7B3f5c1adb-a179-4718-8e9f-0b616dd7abe7%7D HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: cpprestsdk/2.8.0Host: settings-win.data.microsoft.com
Source: global traffic	HTTP traffic detected: GET /page/FynP6ihgtLS9G/; HTTP/1.1Host: spark.adobe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/runtime.gz.css HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://spark.adobe.com/page/FynP6ihgtLS9G/;Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/base-fonts.gz.js HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://spark.adobe.com/page/FynP6ihgtLS9G/;Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/themes/crisp-fonts.gz.js HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://spark.adobe.com/page/FynP6ihgtLS9G/;Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/typekit-load.gz.js HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://spark.adobe.com/page/FynP6ihgtLS9G/;Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/runtime-prod.gz.js HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://spark.adobe.com/page/FynP6ihgtLS9G/;Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /page/FynP6ihgtLS9G/images/02e67f32-ca4c-496f-84a8-9417e377f199.jpg?asset_id=bfff6807-c5d4-41a1-b688-dfc83c07ab40&img_etag=%22985fe67c3e19da60075dc499b740cff9%22&size=1024 HTTP/1.1Host: spark.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://spark.adobe.com/page/FynP6ihgtLS9G/;Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/images/spark_app_white@2x.svg HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://page.adobespark-assets.com/runtime/1.22/runtime.gz.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /experiments/chrome/chrome.js HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://spark.adobe.com/page/FynP6ihgtLS9G/;Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/images/right-arrow.png HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://page.adobespark-assets.com/runtime/1.22/runtime.gz.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/images/left-arrow.png HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://page.adobespark-assets.com/runtime/1.22/runtime.gz.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/images/lightbox_close@2x.png HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://page.adobespark-assets.com/runtime/1.22/runtime.gz.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /page/FynP6ihgtLS9G/images/02e67f32-ca4c-496f-84a8-9417e377f199.jpg?asset_id=bfff6807-c5d4-41a1-b688-dfc83c07ab40&img_etag=%22985fe67c3e19da60075dc499b740cff9%22&size=2560 HTTP/1.1Host: spark.adobe.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://spark.adobe.com/page/FynP6ihgtLS9G/;Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/images/favicon.ico HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://spark.adobe.com/page/FynP6ihgtLS9G/;Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/images/favicon.ico HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: page.adobespark-assets.com
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /page/FynP6ihgtLS9G/;?page-mode=static HTTP/1.1Host: spark.adobe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /runtime/1.22/noscript.gz.css HTTP/1.1Host: page.adobespark-assets.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://spark.adobe.com/page/FynP6ihgtLS9G/;?page-mode=staticAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Acy1k0bLIjHsvnKaKN_oRpVaYYvFs25d7GKYF1WXrT6yizCMksBO0c_ggE0B6tx6HPRHe6q1GOEe3_NcIbSiGG8kXeLMUY0sAKVvC6R89zvKM13s5VqoAMZSmuUgjQL5vlygJuArQghXXE_qTL7NlQ/extension_8520_615_0_5.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /property/ HTTP/1.1Host: arcomet.aeConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /property/css/hover.css HTTP/1.1Host: arcomet.aeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://arcomet.aeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/1.1Host: maxcdn.bootstrapcdn.comConnection: keep-aliveOrigin: https://arcomet.aeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: https://arcomet.aeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /property/images/adobe.jpg HTTP/1.1Host: arcomet.aeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /property/images/gmail1.png HTTP/1.1Host: arcomet.aeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /property/images/outlook1.png HTTP/1.1Host: arcomet.aeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /property/images/aol1.png HTTP/1.1Host: arcomet.aeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /property/images/office3651.png HTTP/1.1Host: arcomet.aeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /property/images/8.jpg HTTP/1.1Host: arcomet.aeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /property/images/other1.png HTTP/1.1Host: arcomet.aeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /property/images/yahoo1.png HTTP/1.1Host: arcomet.aeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /property/images/gmail.png HTTP/1.1Host: arcomet.aeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: arcomet.aeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20211104T062950Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=549577a17d544ed2b6ceda3a9b8cc4c1&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1239137&metered=false&nettype=ethernet&npid=sc-338389&oemName=muoewq%2C%20Inc.&oemid=muoewq%2C%20Inc.&ossku=Professional&smBiosDm=muoewq7%2C1&tl=2&tsu=1239137&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32068&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAVQDLVkDT1mTuizCnMbBwJX1p51hg8O4y7DFKime7VQa0tFV8QpJMZfLxt2Q/E/NfH3xi4lC8MaDIPtR6T2aOrYG+56cXGU1fTYUiFaP0/gxhVEse0l598ZFkWSGZWifoOo0esOzlpKxFpXpxqrSOSWLbLOFVlDB3DNINSFX0DoDexqPWZfLJCDpnEo0naH2jcqP5XFb/rezKPt2hJOT5+5mhcHQiVSdR/nOG9t8dfMDKWe1KHWR77eYrTW5/kBz4m+47Jm2T4zxy6SdLEbEGgJFoG8ZeYMm2GkWehzgpsmQ794FaG7tcK80ey5AnavrpfJqakFVzmNOWQKRSxncf0cDZgAACBqCLq/kV1VnqAGsKDTLSr8cCeSo/AXyjXNOOk7htbfjDoWTkEONLqPvYgimex6AsRsNqda/b7C5oa4/kcmjaM1GpKEHj3P6daY9Mw8I+nR/Okz/xq768t8jIJZnMPvmAdcgBn3lA51y10O5NIsTHyzBGr4GAnu3ALDQzU1LDTAcBxUlbT89VZ0yenUWLJ5JjPej/dJww+c2QBT+rvX0js9tIT0YKIkR1EyAxJXkl8wN2x5taGKIFbxbYQ0zB/S1qW66xiua1fAu8Ih5yGzUPg8P7dUE3qmVbjxRMKMHEpSy8xGOiY25GuBsrrHvjMncIk0UDf2azHvW6f+SMsPrfTl5keOUqVIx41NWNVkI/mymD4rd8HjSGcbxva5/za0a+mS46OeGTHuVgJYGUXNFaaLzmndvLtFnrfCNttk1bhLpdZyZIMkQv0MADalv7P7bH09QOArbTFceVP/ac1ENv/VH+FTU/lwtW4ggL0Q7ahD7vuKCnrr1VtCJXGqkAb5rFXREm55UxN/dE9UJwbqGEH3X3mNFoHcezutx8WXVxuSnF6DkZ5Ddma9m36rCpBI7YwLF1QE=&p=Cache-Control: no-cacheMS-CV: NLHkY1klSky3UgDM.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20211104T062950Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=8859ef262f3a4964bd959c239f1204c1&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1239137&metered=false&nettype=ethernet&npid=sc-280815&oemName=muoewq%2C%20Inc.&oemid=muoewq%2C%20Inc.&ossku=Professional&smBiosDm=muoewq7%2C1&tl=2&tsu=1239137&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32068&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAVQDLVkDT1mTuizCnMbBwJX1p51hg8O4y7DFKime7VQa0tFV8QpJMZfLxt2Q/E/NfH3xi4lC8MaDIPtR6T2aOrYG+56cXGU1fTYUiFaP0/gxhVEse0l598ZFkWSGZWifoOo0esOzlpKxFpXpxqrSOSWLbLOFVlDB3DNINSFX0DoDexqPWZfLJCDpnEo0naH2jcqP5XFb/rezKPt2hJOT5+5mhcHQiVSdR/nOG9t8dfMDKWe1KHWR77eYrTW5/kBz4m+47Jm2T4zxy6SdLEbEGgJFoG8ZeYMm2GkWehzgpsmQ794FaG7tcK80ey5AnavrpfJqakFVzmNOWQKRSxncf0cDZgAACBqCLq/kV1VnqAGsKDTLSr8cCeSo/AXyjXNOOk7htbfjDoWTkEONLqPvYgimex6AsRsNqda/b7C5oa4/kcmjaM1GpKEHj3P6daY9Mw8I+nR/Okz/xq768t8jIJZnMPvmAdcgBn3lA51y10O5NIsTHyzBGr4GAnu3ALDQzU1LDTAcBxUlbT89VZ0yenUWLJ5JjPej/dJww+c2QBT+rvX0js9tIT0YKIkR1EyAxJXkl8wN2x5taGKIFbxbYQ0zB/S1qW66xiua1fAu8Ih5yGzUPg8P7dUE3qmVbjxRMKMHEpSy8xGOiY25GuBsrrHvjMncIk0UDf2azHvW6f+SMsPrfTl5keOUqVIx41NWNVkI/mymD4rd8HjSGcbxva5/za0a+mS46OeGTHuVgJYGUXNFaaLzmndvLtFnrfCNttk1bhLpdZyZIMkQv0MADalv7P7bH09QOArbTFceVP/ac1ENv/VH+FTU/lwtW4ggL0Q7ahD7vuKCnrr1VtCJXGqkAb5rFXREm55UxN/dE9UJwbqGEH3X3mNFoHcezutx8WXVxuSnF6DkZ5Ddma9m36rCpBI7YwLF1QE=&p=Cache-Control: no-cacheMS-CV: NLHkY1klSky3UgDM.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /property/images/adobe.jpg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: arcomet.ae
Source: global traffic	HTTP traffic detected: GET /property/images/gmail1.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: arcomet.ae
Source: global traffic	HTTP traffic detected: GET /property/images/aol1.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: arcomet.ae
Source: global traffic	HTTP traffic detected: GET /property/images/outlook1.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: arcomet.ae
Source: global traffic	HTTP traffic detected: GET /page/FynP6ihgtLS9G HTTP/1.1Host: spark.adobe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /page/FynP6ihgtLS9G/ HTTP/1.1Host: spark.adobe.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /property/images/office3651.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: arcomet.ae
Source: global traffic	HTTP traffic detected: GET /property/images/yahoo1.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: arcomet.ae
Source: global traffic	HTTP traffic detected: GET /property/images/other1.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: arcomet.ae
Source: global traffic	HTTP traffic detected: GET /property/images/gmail.png HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36Host: arcomet.ae
Source: global traffic	HTTP traffic detected: GET /property/ HTTP/1.1Host: arcomet.aeConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: arcomet.aeConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept: image/avif,image/webp,image/apng,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://arcomet.ae/property/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20211104T063027Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=862e217117cd4779b0b1872aa254dbb8&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1239137&metered=false&nettype=ethernet&npid=sc-338388&oemName=muoewq%2C%20Inc.&oemid=muoewq%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=muoewq7%2C1&tl=2&tsu=1239137&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32068&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAVQDLVkDT1mTuizCnMbBwJX1p51hg8O4y7DFKime7VQa0tFV8QpJMZfLxt2Q/E/NfH3xi4lC8MaDIPtR6T2aOrYG+56cXGU1fTYUiFaP0/gxhVEse0l598ZFkWSGZWifoOo0esOzlpKxFpXpxqrSOSWLbLOFVlDB3DNINSFX0DoDexqPWZfLJCDpnEo0naH2jcqP5XFb/rezKPt2hJOT5+5mhcHQiVSdR/nOG9t8dfMDKWe1KHWR77eYrTW5/kBz4m+47Jm2T4zxy6SdLEbEGgJFoG8ZeYMm2GkWehzgpsmQ794FaG7tcK80ey5AnavrpfJqakFVzmNOWQKRSxncf0cDZgAACBqCLq/kV1VnqAGsKDTLSr8cCeSo/AXyjXNOOk7htbfjDoWTkEONLqPvYgimex6AsRsNqda/b7C5oa4/kcmjaM1GpKEHj3P6daY9Mw8I+nR/Okz/xq768t8jIJZnMPvmAdcgBn3lA51y10O5NIsTHyzBGr4GAnu3ALDQzU1LDTAcBxUlbT89VZ0yenUWLJ5JjPej/dJww+c2QBT+rvX0js9tIT0YKIkR1EyAxJXkl8wN2x5taGKIFbxbYQ0zB/S1qW66xiua1fAu8Ih5yGzUPg8P7dUE3qmVbjxRMKMHEpSy8xGOiY25GuBsrrHvjMncIk0UDf2azHvW6f+SMsPrfTl5keOUqVIx41NWNVkI/mymD4rd8HjSGcbxva5/za0a+mS46OeGTHuVgJYGUXNFaaLzmndvLtFnrfCNttk1bhLpdZyZIMkQv0MADalv7P7bH09QOArbTFceVP/ac1ENv/VH+FTU/lwtW4ggL0Q7ahD7vuKCnrr1VtCJXGqkAb5rFXREm55UxN/dE9UJwbqGEH3X3mNFoHcezutx8WXVxuSnF6DkZ5Ddma9m36rCpBI7YwLF1QE=&p=Cache-Control: no-cacheMS-CV: NLHkY1klSky3UgDM.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20211104T063028Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=9972221a113d4a3dbbcf7c2f0575731d&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1239137&metered=false&nettype=ethernet&npid=sc-338387&oemName=muoewq%2C%20Inc.&oemid=muoewq%2C%20Inc.&ossku=Professional&rver=2&sc-mode=0&smBiosDm=muoewq7%2C1&tl=2&tsu=1239137&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32068&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAVQDLVkDT1mTuizCnMbBwJX1p51hg8O4y7DFKime7VQa0tFV8QpJMZfLxt2Q/E/NfH3xi4lC8MaDIPtR6T2aOrYG+56cXGU1fTYUiFaP0/gxhVEse0l598ZFkWSGZWifoOo0esOzlpKxFpXpxqrSOSWLbLOFVlDB3DNINSFX0DoDexqPWZfLJCDpnEo0naH2jcqP5XFb/rezKPt2hJOT5+5mhcHQiVSdR/nOG9t8dfMDKWe1KHWR77eYrTW5/kBz4m+47Jm2T4zxy6SdLEbEGgJFoG8ZeYMm2GkWehzgpsmQ794FaG7tcK80ey5AnavrpfJqakFVzmNOWQKRSxncf0cDZgAACBqCLq/kV1VnqAGsKDTLSr8cCeSo/AXyjXNOOk7htbfjDoWTkEONLqPvYgimex6AsRsNqda/b7C5oa4/kcmjaM1GpKEHj3P6daY9Mw8I+nR/Okz/xq768t8jIJZnMPvmAdcgBn3lA51y10O5NIsTHyzBGr4GAnu3ALDQzU1LDTAcBxUlbT89VZ0yenUWLJ5JjPej/dJww+c2QBT+rvX0js9tIT0YKIkR1EyAxJXkl8wN2x5taGKIFbxbYQ0zB/S1qW66xiua1fAu8Ih5yGzUPg8P7dUE3qmVbjxRMKMHEpSy8xGOiY25GuBsrrHvjMncIk0UDf2azHvW6f+SMsPrfTl5keOUqVIx41NWNVkI/mymD4rd8HjSGcbxva5/za0a+mS46OeGTHuVgJYGUXNFaaLzmndvLtFnrfCNttk1bhLpdZyZIMkQv0MADalv7P7bH09QOArbTFceVP/ac1ENv/VH+FTU/lwtW4ggL0Q7ahD7vuKCnrr1VtCJXGqkAb5rFXREm55UxN/dE9UJwbqGEH3X3mNFoHcezutx8WXVxuSnF6DkZ5Ddma9m36rCpBI7YwLF1QE=&p=Cache-Control: no-cacheMS-CV: NLHkY1klSky3UgDM.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20211104T063031Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=0d46fe1d78d040f6913ef63f791085d4&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1239137&metered=false&nettype=ethernet&npid=sc-338389&oemName=muoewq%2C%20Inc.&oemid=muoewq%2C%20Inc.&ossku=Professional&smBiosDm=muoewq7%2C1&tl=2&tsu=1239137&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32068&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAVQDLVkDT1mTuizCnMbBwJX1p51hg8O4y7DFKime7VQa0tFV8QpJMZfLxt2Q/E/NfH3xi4lC8MaDIPtR6T2aOrYG+56cXGU1fTYUiFaP0/gxhVEse0l598ZFkWSGZWifoOo0esOzlpKxFpXpxqrSOSWLbLOFVlDB3DNINSFX0DoDexqPWZfLJCDpnEo0naH2jcqP5XFb/rezKPt2hJOT5+5mhcHQiVSdR/nOG9t8dfMDKWe1KHWR77eYrTW5/kBz4m+47Jm2T4zxy6SdLEbEGgJFoG8ZeYMm2GkWehzgpsmQ794FaG7tcK80ey5AnavrpfJqakFVzmNOWQKRSxncf0cDZgAACBqCLq/kV1VnqAGsKDTLSr8cCeSo/AXyjXNOOk7htbfjDoWTkEONLqPvYgimex6AsRsNqda/b7C5oa4/kcmjaM1GpKEHj3P6daY9Mw8I+nR/Okz/xq768t8jIJZnMPvmAdcgBn3lA51y10O5NIsTHyzBGr4GAnu3ALDQzU1LDTAcBxUlbT89VZ0yenUWLJ5JjPej/dJww+c2QBT+rvX0js9tIT0YKIkR1EyAxJXkl8wN2x5taGKIFbxbYQ0zB/S1qW66xiua1fAu8Ih5yGzUPg8P7dUE3qmVbjxRMKMHEpSy8xGOiY25GuBsrrHvjMncIk0UDf2azHvW6f+SMsPrfTl5keOUqVIx41NWNVkI/mymD4rd8HjSGcbxva5/za0a+mS46OeGTHuVgJYGUXNFaaLzmndvLtFnrfCNttk1bhLpdZyZIMkQv0MADalv7P7bH09QOArbTFceVP/ac1ENv/VH+FTU/lwtW4ggL0Q7ahD7vuKCnrr1VtCJXGqkAb5rFXREm55UxN/dE9UJwbqGEH3X3mNFoHcezutx8WXVxuSnF6DkZ5Ddma9m36rCpBI7YwLF1QE=&p=Cache-Control: no-cacheMS-CV: NLHkY1klSky3UgDM.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4MzKU?ver=b3db HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20211104T063033Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=95be6b284d694cec9532c9bf08d1eb55&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1239137&metered=false&nettype=ethernet&npid=sc-280815&oemName=muoewq%2C%20Inc.&oemid=muoewq%2C%20Inc.&ossku=Professional&smBiosDm=muoewq7%2C1&tl=2&tsu=1239137&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50583&fs=32068&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAVQDLVkDT1mTuizCnMbBwJX1p51hg8O4y7DFKime7VQa0tFV8QpJMZfLxt2Q/E/NfH3xi4lC8MaDIPtR6T2aOrYG+56cXGU1fTYUiFaP0/gxhVEse0l598ZFkWSGZWifoOo0esOzlpKxFpXpxqrSOSWLbLOFVlDB3DNINSFX0DoDexqPWZfLJCDpnEo0naH2jcqP5XFb/rezKPt2hJOT5+5mhcHQiVSdR/nOG9t8dfMDKWe1KHWR77eYrTW5/kBz4m+47Jm2T4zxy6SdLEbEGgJFoG8ZeYMm2GkWehzgpsmQ794FaG7tcK80ey5AnavrpfJqakFVzmNOWQKRSxncf0cDZgAACBqCLq/kV1VnqAGsKDTLSr8cCeSo/AXyjXNOOk7htbfjDoWTkEONLqPvYgimex6AsRsNqda/b7C5oa4/kcmjaM1GpKEHj3P6daY9Mw8I+nR/Okz/xq768t8jIJZnMPvmAdcgBn3lA51y10O5NIsTHyzBGr4GAnu3ALDQzU1LDTAcBxUlbT89VZ0yenUWLJ5JjPej/dJww+c2QBT+rvX0js9tIT0YKIkR1EyAxJXkl8wN2x5taGKIFbxbYQ0zB/S1qW66xiua1fAu8Ih5yGzUPg8P7dUE3qmVbjxRMKMHEpSy8xGOiY25GuBsrrHvjMncIk0UDf2azHvW6f+SMsPrfTl5keOUqVIx41NWNVkI/mymD4rd8HjSGcbxva5/za0a+mS46OeGTHuVgJYGUXNFaaLzmndvLtFnrfCNttk1bhLpdZyZIMkQv0MADalv7P7bH09QOArbTFceVP/ac1ENv/VH+FTU/lwtW4ggL0Q7ahD7vuKCnrr1VtCJXGqkAb5rFXREm55UxN/dE9UJwbqGEH3X3mNFoHcezutx8WXVxuSnF6DkZ5Ddma9m36rCpBI7YwLF1QE=&p=Cache-Control: no-cacheMS-CV: NLHkY1klSky3UgDM.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWEG5Q?ver=3705 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4MmCW?ver=2faf HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWEwqt?ver=a195 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWHg6R?ver=6da4 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RE4MrRK?ver=1b0e HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cms/api/am/imageFileData/RWHvIs?ver=50f7 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134Host: img-prod-cms-rt-microsoft-com.akamaized.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:D9BC7EDF-91E8-C8ED-3ED4-3B144B30C00C&ctry=US&time=20211104T063108Z&lc=en-US&pl=en-US&idtp=mid&uid=a9223225-82ba-4622-a95e-dcecd6738abd&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=f767bd69c9bc4a8eba92051c8fe62080&ctmode=MultiSession&arch=x64&cdm=1&cdmver=10.0.17134.1&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.17134.1&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=1239138&metered=false&nettype=ethernet&npid=sc-310091&oemName=muoewq%2C%20Inc.&oemid=muoewq%2C%20Inc.&ossku=Professional&rver=2&smBiosDm=muoewq7%2C1&tl=2&tsu=1239138&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing= HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50583&fs=32068&sc=6X-SDK-HW-TOKEN: t=EwDYAppeBAAU+CVBfQcFvEv2DZI9cfqZBAbEzGMAAVQDLVkDT1mTuizCnMbBwJX1p51hg8O4y7DFKime7VQa0tFV8QpJMZfLxt2Q/E/NfH3xi4lC8MaDIPtR6T2aOrYG+56cXGU1fTYUiFaP0/gxhVEse0l598ZFkWSGZWifoOo0esOzlpKxFpXpxqrSOSWLbLOFVlDB3DNINSFX0DoDexqPWZfLJCDpnEo0naH2jcqP5XFb/rezKPt2hJOT5+5mhcHQiVSdR/nOG9t8dfMDKWe1KHWR77eYrTW5/kBz4m+47Jm2T4zxy6SdLEbEGgJFoG8ZeYMm2GkWehzgpsmQ794FaG7tcK80ey5AnavrpfJqakFVzmNOWQKRSxncf0cDZgAACBqCLq/kV1VnqAGsKDTLSr8cCeSo/AXyjXNOOk7htbfjDoWTkEONLqPvYgimex6AsRsNqda/b7C5oa4/kcmjaM1GpKEHj3P6daY9Mw8I+nR/Okz/xq768t8jIJZnMPvmAdcgBn3lA51y10O5NIsTHyzBGr4GAnu3ALDQzU1LDTAcBxUlbT89VZ0yenUWLJ5JjPej/dJww+c2QBT+rvX0js9tIT0YKIkR1EyAxJXkl8wN2x5taGKIFbxbYQ0zB/S1qW66xiua1fAu8Ih5yGzUPg8P7dUE3qmVbjxRMKMHEpSy8xGOiY25GuBsrrHvjMncIk0UDf2azHvW6f+SMsPrfTl5keOUqVIx41NWNVkI/mymD4rd8HjSGcbxva5/za0a+mS46OeGTHuVgJYGUXNFaaLzmndvLtFnrfCNttk1bhLpdZyZIMkQv0MADalv7P7bH09QOArbTFceVP/ac1ENv/VH+FTU/lwtW4ggL0Q7ahD7vuKCnrr1VtCJXGqkAb5rFXREm55UxN/dE9UJwbqGEH3X3mNFoHcezutx8WXVxuSnF6DkZ5Ddma9m36rCpBI7YwLF1QE=&p=Cache-Control: no-cacheMS-CV: nYr/S2vc0EWUERRk.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: tch0,m301,m751,mA01,mT01Host: arc.msn.comConnection: Keep-Alive

URLs found in memory or binary data

Source: angular.js.0.dr	String found in binary or memory: http://angularjs.org
Source: data_3.1.dr	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: data_3.1.dr	String found in binary or memory: http://crl.pki.goog/gtsr1/gtsr1.crl0W
Source: data_3.1.dr	String found in binary or memory: http://crls.pki.goog/gts1c3/QOvJ0N1sT2A.crl0
Source: angular.js.0.dr	String found in binary or memory: http://errors.angularjs.org/1.6.4-local
Source: data_3.1.dr	String found in binary or memory: http://google.com
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: data_3.1.dr	String found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: data_3.1.dr	String found in binary or memory: http://ocsp.pki.goog/gts1c301
Source: data_3.1.dr	String found in binary or memory: http://ocsp.pki.goog/gtsr100
Source: data_3.1.dr	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: data_3.1.dr	String found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
Source: data_3.1.dr	String found in binary or memory: http://pki.goog/repo/certs/gtsr1.der04
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://tools.ietf.org/html/rfc1950
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: Reporting and NEL.1.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=HrhX4W6wWeoQzGIdLqqQxKthYoRDUeg84%2BinRZ%2BUNcfPdHx5zvEhGm2
Source: Reporting and NEL.1.dr	String found in binary or memory: https://a.nel.cloudflare.com/report/v3?s=vwazFNDoBYsAhnOQY9BmgxoOKI0dA%2BVEDItLFwnfOnvMwHOBFAd0Ou%2B
Source: 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr, manifest.json0.0.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr	String found in binary or memory: https://ajax.googleapis.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://ajax.googleapis.com/
Source: data_1.1.dr, data_3.1.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr, manifest.json0.0.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://apis.google.com
Source: mirroring_common.js.0.dr	String found in binary or memory: https://apis.google.com/js/client.js
Source: Network Action Predictor.0.dr	String found in binary or memory: https://arcomet.ae/
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/favicon.ico
Source: Current Session.0.dr, data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/M
Source: History.0.dr	String found in binary or memory: https://arcomet.ae/property/Share
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/css/hover.css
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/images/8.jpg
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/images/8.jpgP9o
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/images/adobe.jpg
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/images/aol1.png
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/images/gmail.png
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/images/gmail1.png
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/images/office3651.png
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/images/other1.png
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/images/other1.pngF
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/images/outlook1.png
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/images/outlook1.pngH
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/images/yahoo1.png
Source: data_1.1.dr	String found in binary or memory: https://arcomet.ae/property/images/yahoo1.png2o
Source: Current Session.0.dr	String found in binary or memory: https://arcomet.ae/property/lt
Source: mirroring_common.js.0.dr	String found in binary or memory: https://castedumessaging-pa.googleapis.com/v1
Source: data_1.1.dr, data_3.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: data_1.1.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.jskf
Source: pnacl_public_x86_64_libcrt_platform_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_libcrt_platform_a.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://clients2.google.com
Source: mirroring_hangouts.js.0.dr, mirroring_cast_streaming.js.0.dr	String found in binary or memory: https://clients2.google.com/cr/report
Source: manifest.json1.0.dr, manifest.json0.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://clients6.google.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: Network Action Predictor.0.dr	String found in binary or memory: https://code.jquery.com/
Source: data_1.1.dr, data_3.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: data_1.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js&
Source: data_1.1.dr, data_3.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: data_1.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js/
Source: data_3.1.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.js
Source: 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr	String found in binary or memory: https://content-autofill.googleapis.com
Source: data_1.1.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIfCb3s_TLdqtJXEgk
Source: data_1.1.dr	String found in binary or memory: https://content-autofill.googleapis.com/v1/pages/Chc2LjEuMTcxNS4xNDQyL2VuIChHR0xMKRIqCQZysTgJBJI4Egk
Source: manifest.json0.0.dr	String found in binary or memory: https://content.googleapis.com
Source: mirroring_cast_streaming.js.0.dr, common.js.0.dr	String found in binary or memory: https://crash.corp.google.com/samples?reportid=&q=
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/.
Source: data_3.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushers
Source: data_3.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/hosted-libraries-pushersCross-Origin-Resource-Policy:
Source: Reporting and NEL.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external
Source: data_3.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdfmR0fDhCOPhF1MuC4lh4qBOg6Nc66MCVJYeKk
Source: data_3.1.dr	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers
Source: 7facb409-048a-4d6a-840e-4b8611829896.tmp.1.dr, 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr, 6f4e6201-7fcb-437e-bcf0-abc41b973b05.tmp.1.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr, d5708b5d-efcf-4c5e-a5bd-99f41c071daf.tmp.1.dr	String found in binary or memory: https://dns.google
Source: mirroring_common.js.0.dr	String found in binary or memory: https://docs.google.com
Source: manifest.json0.0.dr	String found in binary or memory: https://feedback.googleusercontent.com
Source: 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://fonts.googleapis.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://fonts.googleapis.com/
Source: data_1.1.dr, data_3.1.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Yellowtail&display=swap
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.googleapis.com;
Source: data_3.1.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://fonts.gstatic.com
Source: data_1.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/yellowtail/v11/OZpGg_pnoDtINPfRIlLohlvHwQ.woff2)
Source: manifest.json0.0.dr	String found in binary or memory: https://fonts.gstatic.com;
Source: material_css_min.css.0.dr	String found in binary or memory: https://github.com/angular/material
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://github.com/madler/zlib/blob/master/zlib.h
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.clients6.google.com
Source: manifest.json0.0.dr	String found in binary or memory: https://hangouts.google.com/
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://hangouts.google.com/hangouts/_/logpref
Source: data_3.1.dr	String found in binary or memory: https://ka-f.fontawesome.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://ka-f.fontawesome.com/
Source: data_1.1.dr	String found in binary or memory: https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251
Source: data_1.1.dr	String found in binary or memory: https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251
Source: data_3.1.dr	String found in binary or memory: https://kit.fontawesome.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://kit.fontawesome.com/
Source: data_1.1.dr, data_3.1.dr	String found in binary or memory: https://kit.fontawesome.com/585b051251.js
Source: Network Action Predictor.0.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/
Source: data_1.1.dr, data_3.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
Source: data_1.1.dr, data_3.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: data_1.1.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.jsg
Source: mirroring_common.js.0.dr	String found in binary or memory: https://meet.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://meetings.clients6.google.com
Source: mirroring_common.js.0.dr	String found in binary or memory: https://networktraversal.googleapis.com/v1alpha
Source: 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://ogs.google.com
Source: Network Action Predictor.0.dr	String found in binary or memory: https://page.adobespark-assets.com/
Source: data_1.1.dr	String found in binary or memory: https://page.adobespark-assets.com/experiments/chrome/chrome.js
Source: data_1.1.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/base-fonts.gz.js
Source: data_1.1.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/base-fonts.gz.jsW$
Source: data_1.1.dr, Favicons.0.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/images/favicon.ico
Source: data_1.1.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/images/left-arrow.png
Source: data_1.1.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/images/lightbox_close
Source: data_1.1.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/images/right-arrow.png
Source: data_1.1.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/images/spark_app_white
Source: data_1.1.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/noscript.gz.css
Source: data_1.1.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/runtime-prod.gz.js
Source: data_1.1.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/runtime.gz.css
Source: data_1.1.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/themes/crisp-fonts.gz.js
Source: data_1.1.dr	String found in binary or memory: https://page.adobespark-assets.com/runtime/1.22/typekit-load.gz.js
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: data_3.1.dr	String found in binary or memory: https://pki.goog/repository/0
Source: 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://play.google.com
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://preprod-hangouts-googleapis.sandbox.google.com
Source: 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://ssl.gstatic.com
Source: feedback.html.0.dr, messages.json52.0.dr	String found in binary or memory: https://support.google.com/chromecast/answer/2998456
Source: feedback.html.0.dr, messages.json52.0.dr	String found in binary or memory: https://support.google.com/chromecast/troubleshooter/2995236
Source: Network Action Predictor.0.dr	String found in binary or memory: https://use.typekit.net/
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/180c9d/00000000000000003b9b3f8a/27/l?primer=7fa3915bdafdf03041871920a205b
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/37eaae/00000000000000003b9b3f83/27/l?primer=7fa3915bdafdf03041871920a205b
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/3d913c/000000000000000000017709/26/l?subset_id=2&fvd=n6&v=3
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/6c57c4/0000000000000000000158d6/26/l?subset_id=2&fvd=i6&v=3
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/74fc30/0000000000000000000158d4/26/l?subset_id=2&fvd=i1&v=3
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/949f99/00000000000000003b9b3068/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/97fbd1/00000000000000003b9b3f88/27/l?primer=7fa3915bdafdf03041871920a205b
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/9951d2/0000000000000000000158d7/26/l?subset_id=2&fvd=n4&v=3
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/9d1933/00000000000000000001705b/26/l?subset_id=2&fvd=i3&v=3
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/b0c5f5/00000000000000003b9b3f85/27/l?primer=7fa3915bdafdf03041871920a205b
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/d5d9b2/00000000000000000000ffd9/26/l?subset_id=2&fvd=i3&v=3
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/e030d3/0000000000000000000158d3/26/l?subset_id=2&fvd=n1&v=3
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/e030d3/0000000000000000000158d3/26/l?subset_id=2&fvd=n1&v=3oCP
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/edcf1e/0000000000000000000158d9/26/l?subset_id=2&fvd=n3&v=3
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/edcf1e/0000000000000000000158d9/26/l?subset_id=2&fvd=n3&v=3&B
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/af/fe9c8e/0000000000000000000158d8/26/l?subset_id=2&fvd=i4&v=3
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/onz5gap.js
Source: data_1.1.dr	String found in binary or memory: https://use.typekit.net/rbi5aua.js
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr, manifest.json0.0.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://www.google.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: mirroring_hangouts.js.0.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: feedback_script.js.0.dr	String found in binary or memory: https://www.google.com/tools/feedback
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com;
Source: 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, craw_window.js.0.dr, craw_background.js.0.dr, 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/calendar.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/cast-edu-messaging
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/clouddevices
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/hangouts.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/meetings
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.peopleapi.readwrite
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/userinfo.email
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/calendar/v3
Source: mirroring_common.js.0.dr	String found in binary or memory: https://www.googleapis.com/hangouts/v1
Source: 531fb6f0-dbdc-4073-ac03-a9d63b11bd1b.tmp.1.dr, 04bc6489-435e-413c-8894-b6e88e659a65.tmp.1.dr, 06151cbf-848c-49b2-9b89-a1488120e89a.tmp.1.dr	String found in binary or memory: https://www.gstatic.com
Source: common.js.0.dr	String found in binary or memory: https://www.gstatic.com/hangouts_echo_detector/release/%
Source: manifest.json0.0.dr	String found in binary or memory: https://www.gstatic.com;

Posts data to webserver

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 18.10.0.17134.0.0; IDCRL-cfg 16.000.27716.00; App svchost.exe, 10.0.17134.1, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4740Host: login.live.com

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.4:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.4:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.203.70.208:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.11.168.232:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.193.29:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.50.102.62:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.88.152:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.88.152:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.185.88.152:443 -> 192.168.2.4:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.67.82.235:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.82.209.183:443 -> 192.168.2.4:49933 version: TLS 1.2

System Summary:

Creates temporary files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\e3b15f32-ce06-4738-aad2-ce6cfc322d79.tmp

Jump to behavior

Classification label

Source: classification engine

Classification label: mal92.phis.win@33/250@14/13

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --enable-automation "https://spark.adobe.com/page/FynP6ihgtLS9G/;
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,6134992091823361371,9274942895234856364,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,6134992091823361371,9274942895234856364,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1932 /prefetch:8			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown			Jump to behavior

Found detection on Joe Sandbox Cloud Basic with higher score

Source: https://spark.adobe.com/page/FynP6ihgtLS9G/;

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61837DB9-1944.pma

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected